FreeBSD git weekly: 2026-09-28 to 2026-10-04

Add mountpoint(1), a simple utility to tell whether the file pointed
to by the argument is a mount point.  It prints whether it is, unless
-q is given, and exits 0 if it is, 1 if it is not, and 2 on error.

The answer comes from the kernel with a single stat(2): the root vnode
of a mounted file system is reported with SFBSD_MNTPOINT in
st_bsdflags.  Unlike comparing realpath(3) of the argument with that
of statfs(2)'s f_mntonname, this works for arbitrarily deep
hierarchies, and after chroot(2) or inside a jail.  A chroot or jail
root is reported as a mount point only if it is one.

The argument does not have to be a directory: file systems such as
nullfs(5) can be mounted over regular files and sockets, and stat(2)
reports those mount points as well.

Since all that is needed is one stat(2) call, make mountpoint a
hardlink to stat(1), the same way readlink(1) is, and document it in
stat.1.

Add ATF tests, including chroot(8) and jail(8) roots that are and are
not mount points, nullfs roots, file systems mounted inside the root,
both from the host and from within the jail, and a nullfs mount of a
file over a file.

Suggested by:   kib
Differential revision:  https://reviews.freebsd.org/D59906
Sponsored by:   Sippy Software, Inc.
MFC after:      2 weeks

If realloc fails, clean up and return ENOMEM; don't just copy data
into NULL.

Reviewed by:    emaste
Reported by:    Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60147

The image_file_map function adjusts the provided file offset to be
page-aligned, with a resulting increase in the size of the mapped
region; the increased size needs to be used when unmapping as well.

Reported by:    Claude Opus 5.5
Fixes:  https://cgit.freebsd.org/src/commit/?id=baf4abfc39b2 ("Allow building mkimg as cross-tool")
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60148

This is like image_copyout_region, but copies into a buffer rather than
writing out to a file; it will be used by future support for compressed
images (and potentially other circumstances where image data must be
manipulated before being written out to disk).

Reviewed by:    jrm
No objection from:      Christos Komis (author)
MFC after:      2 weeks
Sponsored by:   Google LLC (GSoC 2025)
Differential Revision:  https://reviews.freebsd.org/D60149

This will allow it to be reused in upcoming work.

Suggested by:   Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60150

FreeBSD VM/cloud images tend to be highly compressible: The generic VM
images compress roughly 3.5:1, and cloud images typically even more
since they have significant unused space in their virtual disks.  This
generally doesn't matter for users who can download compressed release
images and extract them locally, but for EC2 in particular relying on
uncompressed image formats is painful: We now upload over 500 GB/week
to AWS.

This commit adds the "stream-optimized" version of the VMDK format,
which compresses each 64 kB "grain" individually (and omits grains
which are all zeroes).  Compared to uncompressed formats, this can
produce much smaller images; experiments indicate that using this
format for EC2 image uploads will reduce the weekly traffic to under
100 GB/week.

Co-authored-by: Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60151

MFC after:            3 days
Reviewed by:            glebius, wulf
Differential Revision:  https://reviews.freebsd.org/D59869

MFC after:            3 days
Reviewed by:            wulf
Differential Revision:  https://reviews.freebsd.org/D59257

Sponsored by: The FreeBSD Foundation
MFC after:      3 days

MFC after:    3 days

MFC after:    3 days

MFC after:    3 days

MFC after:    3 days

Reviewed by:  ziaee, imp
Differential Revision:  https://reviews.freebsd.org/D59938

Reviewed by:  sobomax, markj, olce
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59910

MFC after:    1 week

MFC after:    1 week

Add a note that UEFI VMs using TPM devices should be configured
to use a varfile. Some UEFI boot loaders, such as shim, update
persistent boot variables and then reset the system when a TPM is
present. Without a writable varfile, the VM may be reset repeatedly.

Add a TPM device example to the examples list.

While here, add a missing "\" to the "uefivm" example, and add ".Pp"
before the vCPU pinning examples for consistency with other examples.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=287326
Reviewed by:    michaelo, ziaee
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D60181

Reviewed by:  ziaee
Co-authored-by: Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60152

Patch adding Total Port Shutdown support incorrectly
handled a case when this feature was not enabled in the NVM.
When TPS bit is not set driver should apply link configuration
according to user settings and update the status. Those steps
were mistakenly omitted, while the state flag was still set
to prevent link renegotation and status update on first
attempt to bring interface up with ifconfig.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reported by:    kbowling
Reviewed by:    kbowling
Fixes:          https://cgit.freebsd.org/src/commit/?id=0011cd9f8863 ("ice(4): Support Total Port Shutdown on E830 devices")
MFC after:      2 weeks
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D59578

Correct the byte order at the driver interfaces that do not operate in
host order. Encode little-endian Admin Queue VSI and MAC/VLAN fields,
and decode firmware-provided queue handles, statistics indices, and
event parameters before using them.

Decode transmit descriptor writeback before examining it, and construct
VLAN descriptor fields in host order for the final descriptor
conversion. Store paged HMC descriptors in little-endian form and retain
the selected field bits when reading HMC contexts.

Keep MMIO values in host order for bus-space accessors and remove the
obsolete le16_to_cpu no-op macro. In particular, retain the atomic
bus_space_read_8() used for 64-bit registers.

On big-endian systems, the unconverted perfect-match filter flag is
presented to firmware as 0x0100 instead of 0x0001. Firmware rejects that
command with EINVAL, leaving receive traffic functional only in
promiscuous mode.

Reviewed by:    kbowling
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation, Reliable Computer Systems Lab
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2408

The radix kremove implementation cleared a kernel PTE without
invalidating its TLB entry.  Reusing crashdumpmap could therefore keep
accessing an old physical page, causing minidumps to contain repeated
stale page contents.

Invalidate the removed kernel mapping and synchronize newly installed
kernel PTEs before they are accessed.

Reviewed by:    jhibbits
Approved by:    olce (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=65bbba25d214 ("powerpc64: Implement Radix MMU for POWER9 CPUs")
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59728

libkvm locates the sparse page array after the page-rounded PTE table
size, but the ARM minidump writer emitted only the unrounded size.  When
the table size was not page-aligned, libkvm therefore read every dumped
physical page at the wrong offset.

The mismatch was introduced when libkvm began rounding ptesize.  It has
affected ARM minidumps since ffdeef323449 ("libkvm: Improve physical
address lookup scaling."). It is exposed when the dumped KVA span is not
a multiple of 4 MiB.

Zero-pad the final PTE page and include the padding in the dump size.

Reviewed by:    jhb
Approved by:    jhb (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=ffdeef323449 ("libkvm: Improve physical address lookup scaling.")
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59716

The radix pmap did not implement the minidump pmap callbacks, so radix
minidumps were emitted with an empty pmap section.  Such dumps do not
contain enough information for libkvm to translate kernel virtual
addresses.

Snapshot the 64KB radix root table in the pmap section, add lower-level
page-table pages to the sparse dump, and include pages backing non-DMAP
kernel mappings.  Keep the bulk direct map out of the dump while
retaining the relocated kernel image.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298532
Reviewed by:    jhb
Approved by:    jhb (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59743

Add some additional diagnostic output for IPMI code,
particularly on error paths. This has been found to be helpful at
$WORK and seems generally useful, so contributing the changes back to
upstream.

Sponsored by: Dell Technologies
Reviewed by: vangyzen@
Differential Revision: https://reviews.freebsd.org/D60091

Service each IBS unit with a valid bit set when fetch and op share an
NMI. Otherwise, op samples can be lost. Treat the extra NMI that follows
as expected (skip it).

Reviewed by:    mhorne
Fixes:  https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Differential Revision:  https://reviews.freebsd.org/D60004

hwpmc_amd: add PerfMonV2 global-control path

Add support for AMD PerfMonV2 (Family 19h+) core counters, which need
both the per-counter EVSEL enable bit and the global GLOBAL_CTL bit set
to count. Detects PerfMonV2 at init and switches to v2-specific
start/stop/interrupt handlers; older CPUs and L3/DF counters keep using
the classic path unchanged.

Adds a read-only sysctl, kern.hwpmc.amd_perfmon_v2, to report which path
is active.

Signed-off-by:  Andre Silva <andasilv@amd.com>
Reviewed by:    Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58256

hwpmc: fix stopping process PMCs on exit with PerfMonV2

Since 9d3064010590, pmc_process_exit() calls pmc_process_csw_stop_all()
first. That clears pps_cpustate for every virtual PMC on the CPU, so the
exit loop then skips the stop and the final read.

On AMD PerfMonV2 this has two effects:
- The count from the last time slice is lost. A process that never
  switches out before exit reports 0 with pmcstat -p.
- The EVSEL enable bit stays set. After kldunload, the next kldload
  sees it and says "PMCs maybe in use by firmware!".

It is not required that pmc_process_csw_stop_all() should touch the
ppc_cpustate field at all; remove this to fix the issues.

Reviewed by:    mhorne
Fixes:          https://cgit.freebsd.org/src/commit/?id=9d3064010590 ("hwpmc_amd: add PerfMonV2 global-control path")
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D60141

Some firmware assigns only one bus number to each PCI-PCI bridge.  This
prevents later SR-IOV VF enumeration when a VF routing ID falls on a bus
number already allocated to a sibling bridge.

Reserve only the additional bus numbers required by SR-IOV PFs.
Enumerate all directly attached functions before child drivers and
bridges attach, inspect their device_t objects for SR-IOV, and grow the
PCI bus resource through the highest possible VF routing ID.

First VF Offset and VF Stride may change when NumVFs changes.  Probe
every valid NumVFs value and preserve the original setting.  When the
upstream hierarchy uses ARI, temporarily enable the SR-IOV ARI Hierarchy
control in the lowest-numbered PF while sizing, then restore it.  Scope
active-VF detection to each conventional PCI slot; an ARI bus remains
one slot-0 hierarchy.  If firmware left VFs enabled on a device, do not
modify it and reserve only its active layout.

During runtime configuration, consult the PCI bus's owned resource
range rather than PCI-PCI bridge registers.  This recognizes an existing
boot-time reservation beneath both PCI-PCI and host bridges and avoids a
second, overlapping bus-number allocation.

This avoids consuming bus numbers behind unrelated bridges.  The runtime
allocation in pci_iov.c remains as a fallback when the boot-time range
cannot be enlarged.  hw.pci.clear_buses remains useful when firmware
assigned a required number to another bridge before enumeration.

Validated the targeted implementation on an Intel E810-XXV behind a
non-ARI root port.  With hw.pci.clear_buses=1 and no global reserve
tunable, the PF bridge received buses 1-2 while three unrelated bridges
each received one bus.  A VF with First VF Offset 0x100 attached as
iavf0 at pci0:2:0:0, and detached cleanly.

Reviewed by:    jhb, manpages (ziaee)
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58624

Retain the PF-accepted MAC and VLAN settings from the per-port t4iov
companion and expose them through the corresponding cxgbe ifnet.

Publish, snapshot, and destroy the cache under the existing adapter
synchronized-operation mechanism so status queries cannot race IOV
configuration or teardown.

Track successful t4iov attachment independently of the active VF count.
Restrict reporting to the port main VI, return an empty status for a
supported but unconfigured PF, and omit status from VF and auxiliary
VIs.

Reviewed by:    jhb
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58741

Reviewed by:  markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D60111

Sponsored by: The FreeBSD Foundation
MFC after:      3 days

m_defrag() has pointer-return ownership semantics: success frees the
original chain and returns a replacement, while failure returns NULL and
leaves the original owned by the caller.  rge_encap() compared that
pointer as an integer status and could return failure after success,
causing rge_tx_task() to free its stale old head.

Pass the mbuf by reference, retain the replacement returned by
m_defrag(), and publish it to the caller before retrying DMA mapping.  A
later mapping failure is then cleaned up through the current chain, and
a successful transmission uses that same chain for BPF and TX ownership.

An unprivileged process can reach the EFBIG branch in mapped-sendfile
mode.

Signed-off-by: Andrew Griffiths <andrew@calif.io>

Reviewed by:    adrian, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D60142

Fix build and check return code of intr_ipi_pic_register().

Reviewed by:    Sarah Walker <sarah.walker2@arm.com>
Differential Revision:  https://reviews.freebsd.org/D60071

I have a Logitech mouse that reports 16 buttons.  Bump to 32 to be a
little more future proof.  This increases the size of struct hid_item
but this struct is not exported to userland.

Reviewed by:    wulf
Differential Revision:  https://reviews.freebsd.org/D59273

Support new versions 4.x and 5.x of Synopsys DesignWare Gigabit
Ethernet MAC, often referred to as DWC Quality-of-Service IP Core.

In particular:
- version 5_30 (0x53) that is found on stm32mp2 arm64 SoC
- version 5_40 (0x54) that is found on Spacemit K3 RISC-V RVA23 SoC

DWC Ethernet QoS introduced a new scalable multi-channel architecture
with up to eight TX/RX channels, enhanced DCB support, TCP segmentation
offload (TSO).

Thanks to manu@ for start splitting out the DMA code of the older
(dwc version 3.x) driver to separate files in 2023.  This patch is
a continuation of that work to support new core and DMA engine.

Thanks to mmel@ for initial review.  Initial support covers the same
interface capabilities as the version 3 (VLAN_MTU, HWCSUM, HWCSUM_IPV6).

Reviewed by:    mmel
No objection:   manu
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D59191

ARI changes RID interpretation only for the device on a downstream
port's secondary bus.  pcib_xlate_ari() applied that translation to
every config access through an ARI-enabled bridge, including cycles
forwarded to a subordinate bus.

A non-zero slot on a subordinate bus then panics an INVARIANTS kernel
and is misrouted otherwise.  Translate only when the access targets
this bridge's secondary bus.

Reviewed by:    kib, jhb
Fixes:          https://cgit.freebsd.org/src/commit/?id=55d3ea1731d1 ("Add support for PCIe ARI")
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D60033

The VMX backend did not handle EXIT_REASON_TRIPLE_FAULT, so a hardware
triple fault fell through as an unhandled exit: bhyve printed a raw VMX
exit dump and aborted, instead of suspending the VM with the
reason the software exception path already uses.

Add the missing case so the VM suspends with VM_SUSPEND_TRIPLEFAULT and
bhyve exits with BHYVE_EXIT_TRIPLEFAULT.  This matches illumos change 14664.

Obtained from:  illumos 83b49c54d9c0766e810b6c8ff849dfb6693fc68a
Reviewed by:    bnovkov, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D59840

acpi_timer: Trim some more leftovers from the ACPI-safe timer

The "safe" variant of the hook to read the timer is no longer used and
can be removed.  Instead, initialize the get_timecount member of
acpi_timer_timecounter to the normal hook statically.  While here,
initialize a few more fields in acpi_timer_timecounter statically.
I've kept the name as just "ACPI" instead of "ACPI-fast" now.

During device probe there is no longer any reason to alloc the
register resource since it is not used, so remove all that.  While
here, defer registration of the timecounter until attach (kind of odd
to do such a thing during probe leaving a window where the timer
register was unallocated but in theory could still be read via the
timecounter).

Reviewed by:    cperciva
Fixes:          https://cgit.freebsd.org/src/commit/?id=00d061855deb ("Garbage-collect ACPI-safe timer and friends")
Differential Revision:  https://reviews.freebsd.org/D59933

acpi_timer: I/O resource cleanups

- Use bus_read_4 and remove explicit bus_space tag and handle

- Pass rid by value to bus_alloc_resource_any

Differential Revision:  https://reviews.freebsd.org/D59934

acpi_timer: Remove unneeded acpi_timer_freq global variable

This was just an alias of acpi_timer_timecounter.tc_frequency.  While
here, register the machdep.acpi_timer_freq sysctl node dynamically
only if the driver attaches rather than making the handler fail with
EOPNOTSUPP if the driver had not attached.

Differential Revision:  https://reviews.freebsd.org/D59935

acpi_timer: Add a softc to avoid use of global variables

Add a softc and use it to mostly replace the use of global variables
in this driver.  Simplify the suspend and resume event handlers by
saving the old timecounter in the softc and passing the softc pointer
to the handlers.

Differential Revision:  https://reviews.freebsd.org/D59936

Report failure as if the request had failed.  This causes apm(8) to
correctly report the resume timer as "unknown" rather than random
garbage.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D59939

This avoids looking it up via a slower path in apmopen.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D59940

Drop support for queries and commands that are not supported by ACPI's
/dev/apm interface.  This includes dropping support for
enabling/disabling APM BIOS used by /etc/rc.d/apm.

Reviewed by:    ziaee, imp
Differential Revision:  https://reviews.freebsd.org/D59941

This simplifies the logic around ACKing suspend requests as there is
no longer the potential for multiple listeners, only devd and the
acknowledgement via acpiconf -k.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D59942

cxgbe: Don't query mbuf_nsegs for header-only requests

Sponsored by:   Chelsio Communications

cxgbe: Various assertions for lengths in KTLS work requests

The construction of KTLS work requests is quite fragile, and these
assertions ensure that the constructed work requests match the length
fields encoded in some of the WR structures.

Sponsored by:   Chelsio Communications

cxgbe: Don't cache nsegs for KTLS requests

KTLS mbufs are initially parsed when they are first enqueued to
estimate the number of transmit descriptors needed so that the mbuf is
queued until enough descriptors are available.  As part of this
estimate, the number of DSGL segments required by each KTLS mbuf is
calculated.  Originally, the count for the first TLS record in a chain
was cached in the header mbuf to avoid having to recalculate it when
writing out the actual work request for the first TLS record, but this
requires duplicating fairly complex logic both when parsing and
transmitting requests.

Sponsored by:   Chelsio Communications

cxgbe: Greatly simplify ktls_wr_len for T7

Don't try to fine-tune the WR size when estimating the work request
length when parsing the packet.  Use a much simpler worst-case
estimate that only depends on a few fields in the mbuf metadata.

Sponsored by:   Chelsio Communications

When a request needs to drop data from the crypto output (via a split
mode request), send the last 16 bytes of input as immediate data
instead of via DSGL.  Requests with small payloads (16 bytes or fewer)
are now sent as immediate data only without any DSGL at all.

Sponsored by:   Chelsio Communications

Take action in the presence of the GPIO_PIN_PRESET_LOW/HIGH flags. This
part of the GPIO interface seems to be unused, but is trivially
implemented in our driver.

Reviewed by:    Brian Scott <bscott@bunyatech.com.au>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59991

This provides GPIO programming/configuration at attach time based on the
device tree 'pinmux' descriptions.

Reference:
device-tree/Bindings/pinctrl/starfive,jh7110-sys-pinctrl.yaml

Reviewed by:    Brian Scott <bscott@bunyatech.com.au>
Tested by:      Brian Scott <bscott@bunyatech.com.au>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59992

Disable these by default as they are less efficient and rarely used.

Sponsored by:   Chelsio Communications

While here, make each <machine/ifunc.h> header include <sys/types.h> so
that it can be included standalone.

Reviewed by:    kib
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60167

MFC after:    2 weeks
Sponsored by:   Chelsio Communications

No functional change (intended).

Reviewed by:    markj, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=3a12982962ce ("random: add RDSEED as a provably unique entropy source")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60193

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299002
Reviewed by:    jhb
MFC after:      1 week
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D60203

Current code leads to console text being drawn over the splash image.

vt_flush() draws while holding the vtbuf lock. Have it check VDF_SPLASH
under it too, and make vtterm_splash() take the vtbuf lock when setting
it, before drawing the splash.

Sponsored by:   Defenso
Signed-off-by:  Quentin Thébault <quentin.thebault@defenso.fr>
Reviewed by:    vexeduxr
Differential Revision:  https://reviews.freebsd.org/D59928

amd_intr() and amd_intr_v2() call pmc_ibs_intr() and then update
kern.hwpmc.stats.intr_processed or intr_ignored.  pmc_ibs_intr() also
updated them.  So each core PMC NMI was also counted as ignored, and
each IBS NMI was counted as processed two times.

Update the statistics only in the caller.

Similarly, drop duplicate PMCDBG messages.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D60185

After 40c20fc29cad it is done by vt_core as soon as vt lock is dropped
after vd_init() has been executed to avoid sleeping with non-sleepable
lock held.

Reviewed by:    quentin.thebault_defenso.fr, vexeduxr
Differential Revision:  https://reviews.freebsd.org/D59632

The driver reads cols/rows and sets the tty window size but
never offered the feature, so that code has been dead since
the very beginning; also read size under the configuration
generation count.

Reviewed by:    markj
Approved by:    fuz (mentor)
Differential Revision:  https://reviews.freebsd.org/D60089

virtio_console used the host-supplied used lengths without
validation, so a host could report a length larger than
the buffer, causing the receive and control paths to read
past the end of it.  Clamp to the buffer size.

vtnet already rejected used lengths larger than the buffer,
but performed the check after converting the length to an
int, so a length larger than INT_MAX would become negative
and bypass the check.  Reject such frames early before the
conversion, and count them in ierrors and rx_frame_too_large.

Reviewed by:    markj
Approved by:    fuz (mentor)
Differential Revision:  https://reviews.freebsd.org/D60092

Multiport devices report console size per port by control event,
which was ignored and hence their ttys could never have a window
size.

Reviewed by:    markj
Approved by:    fuz (mentor)
Differential Revision:  https://reviews.freebsd.org/D60094

rss_gethashconfig() is available without options RSS since d9c55b2e8cd6.
Use it to program MRQC, as ixl(4), ice(4) and iavf(4) do, instead of a
fixed field set that included UDP 4-tuple, which the configuration
excludes unless net.inet.rss.udp_4tuple is set.  UDP is now hashed on
addresses only by default.

Also report the UDP hash types on receive; they were passed up as
M_HASHTYPE_NONE.

Reviewed by:            kbowling
Fixes:                  https://cgit.freebsd.org/src/commit/?id=517904de5cca ("igc(4): Introduce new driver for the Intel I225 Ethernet controller.")
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60284

nvme: delete the I/O queues in the system shutdown path

A normal shutdown deletes all I/O submission and completion queues
before setting CC.SHN, as the suspend path already does.  The
device_shutdown path went straight to the shutdown notification with
the queues live, which some drives take slowly or record as an
unclean stop. Skipped the deletion for failed, removed, or
never-initialized controllers.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59633

nvme: do not complete a command when its Abort is not performed

An Abort completion with cdw0 bit 0 set means the controller did not
abort the command; the command can still complete later. The driver
treated this as aborted anyway: it completed the command itself and
freed the CID. When the controller completed the command later,
the CID may already belong to a new command, so the new command
finished with the old command's status, or the unknown-cid assertion
fired on INVARIANTS kernels. The watchdog also kept sending a new
Abort for the same command every half second while the first one was
still pending.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59634

nvme: set the controller Timestamp feature

Controllers that report ONCS.TIMESTAMP keep a millisecond clock that the
host is expected to seed

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59997

When an on-link prefix becomes detached, the kernel keeps
generating new RFC 8981 temporary addresses for that prefix.
Fix it by ignoring the detached addresses in regen_tmpaddr().
While here, change its return type to bool.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298533
Discussed with: markj
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D60051

Since DIOCRSETADDRS was converted to netlink, pf_handle_table_set_addrs()
calls pfr_set_addrs() with a NULL size2, as the netlink interface has no
buffer to return the deleted addresses in. pfr_set_addrs() only checked
size2 for NULL at the end of the function; with PFR_FLAG_FEEDBACK set it
dereferenced it unconditionally first. pfctl sets PFR_FLAG_FEEDBACK
when run with -v, so "pfctl -v -t foo -T replace ..." panicked the
kernel with a NULL pointer dereference. To reproduce:

pfctl -e
pfctl -t foo -T add 192.0.2.1
pfctl -v -t foo -T replace 192.0.2.2

Check size2 for NULL before dereferencing it, as is already done at the
end of the function. The per-address feedback for added and changed
addresses is still copied back as before; only the list of deleted
addresses, which the netlink caller has no room for, is skipped.

While here, compare size2 against NULL explicitly in the second check as
well, per style(9).

Add a regression test.

Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink")
MFC after:              1 week
Differential Revision:  https://reviews.freebsd.org/D60096

pfr_clr_astats() looks up each address it is given and inserts the entry
it finds at the head of a work queue. If the same address is given more
than once, the entry is inserted twice and the second insertion makes it
its own successor. pfr_clstats_kentries() then walks the queue forever,
with the rules lock held for writing, so packet processing and every
other pf operation in that vnet stop as well. To reproduce:

pfctl -e
pfctl -t foo -T add 192.0.2.1
pfctl -t foo -T zero 192.0.2.1 192.0.2.1

Do as pfr_del_addrs() does: clear pfrke_mark on the entries named, then
queue an entry only the first time it is seen. An address given more
than once is cleared, and counted, once. Validate all addresses before
any entry is touched.

Add a regression test.

Reviewed by:            kp
Approved by:            kp (mentor)
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60103

The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list.  The
link-layer address is passed using the ifr_addr field of the request
structure.

struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address).  Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.

Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.

Also validate the sockaddr_dl internal length fields, suggested by zlei.

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    zlei, ae, glebius
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59919

pfi_initialize() registers pfi_rename_ifnet_event() on
ifnet_rename_event, but pfi_cleanup() never deregisters it.  After
"kldunload pf", the next interface rename calls through a stale
pointer into the unloaded module:

kldload pf
kldunload pf
ifconfig epair create
ifconfig epair0a name foo

Reviewed by:    kp
Approved by:    kp (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=349fcf079ca3 ("net: add ifnet_rename_event EVENTHANDLER(9) for interface renaming")
Sponsored by:   Rubicon Communications, LLC ("Netgate")

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298877
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

The netlink encoding of struct pfr_addr omits pfra_fback, so no
per-address feedback reaches userspace.  In particular,
pfr_get_astats() marks entries of tables without counters with
PFR_FB_NOCOUNT, which pfctl uses to skip their counters, so
"pfctl -v -T show" prints zero counters for such tables.

Add PFR_A_FBACK, emit it from the kernel and decode it in libpfctl.

Add a regression test.

Reviewed by:    kp
Approved by:    kp (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=08f54dfca197 ("pf: convert DIOCRGETASTATS to netlink")
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Removal of opt_route.h left route.c without FIB_ALGO, skipping
fib_destroy_rib() in rt_table_destroy(). Explicitly guard it to clean up
fib_algo instances and callouts before releasing the rib_lock rmlock,
preventing a page fault in softclock and VNET resource leaks.

Approved by:    pouria
Fixes:          https://cgit.freebsd.org/src/commit/?id=254b23eb1f5 ("routing: Retire ROUTE_MPATH compile option")
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D60158

The purge thread sets PFI_IFLAG_REFS on the interfaces that states
refer to without the rules lock, under which the other flags are
changed. The updates can interleave, so that a "set skip on" is lost,
or outlives its removal, until the next ruleset load.

Use atomic operations to modify the flags. In the purge thread, only
write if the flag is not already set.

Reviewed by:            kp
Approved by:            kp (mentor)
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60107

pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()

When the PFNL_CMD_ADDRULE message fails to parse, pf_handle_addrule()
frees the rule with pf_free_rule(), which asserts the rules and config
locks (neither is held) and releases references that
pf_ioctl_addrule() has not taken yet. With INVARIANTS this panics on
any parse error; without, a rule address parsed as PF_ADDR_TABLE makes
pfr_detach_table() dereference NULL.

Use pf_krule_free(), as the ioctl paths do.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=e249f5daa41f ("pf: fix memory leak on rule add parse failure")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60104

pf: leave the epoch to purge unlinked rules

pf_purge_thread() calls pf_purge_unlinked_rules() in the network
epoch, where sleeping is not allowed, and it takes pf_config_lock, an
sx lock. If a rule is being added at the time, the purge thread
can sleep on the lock, which panics with INVARIANTS.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=f92d9b1aad73 ("pflow: import from OpenBSD")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60160

pf: take the rules read lock in pf_handle_getrule()

pfctl -sr calls PFNL_CMD_GETRULE once per rule, and
pf_handle_getrule() takes the rules write lock each time, so listing a
ruleset of N rules stops packet processing N times. Only zeroing the
counters (pfctl -z) needs the write lock. Take the read lock
otherwise, as DIOCGETRULENV does.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=777a4702c591 ("pf: implement addrule via netlink")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60161

pf: free the packet rate counter of a rule

pf_ioctl_addrule() allocates a counter_rate for every rule, whether it
has a max-pkt-rate or not, and pf_krule_free() never frees it.

Free it with the rest of the rule.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=ff11f1c8c76c ("pf: add a generic packet rate matching filter")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60190

pf: remove a source limiter from the id tree if its name is taken

When pf_sourcelim_add() finds the name of the new limiter taken, it
undoes the insertion into the id tree with RB_REMOVE() on the name tree,
which the limiter is not in, and then frees the limiter.  The freed
limiter stays in the inactive id tree, and RB_REMOVE() of an element
with no links clears the root of the name tree, which loses every other
inactive limiter from it.  pf_statelim_add() gets this right.

parse.y refuses duplicate names, so pfctl does not get here, but any
netlink client can.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=461648121230 ("pf: introduce source and state limiters")
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60189

pf: return per-address feedback from netlink table test

The PFNL_CMD_TABLE_TEST_ADDRS reply carries only the match count, so
the per-address feedback from pfr_tst_addrs() is lost:
"pfctl -v -T test" lists nothing and "pfctl -vv -T test" reports
every address as "nomatch".

Return each address, as updated by pfr_tst_addrs(), in a nested
PF_TAS_ADDR attribute, and decode them into the caller's array in
libpfctl.  PF_TA_ADDR is not reused: it shares its value with
PF_TAS_ASTATS, which older libpfctl would decode into an
uninitialised target.  That target was also read when no reply was
parsed, so the match count could be garbage; initialise it.

Add a regression test.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=281282e9357b ("pf: convert DIOCRTSTADDRS to netlink")
See also:               https://redmine.pfsense.org/issues/17135
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60146

The check against V_tcp_sendspace is not a correct one, as a buffer may
grow larger than the initial value.  The conjunction was always false up
until 587c6c121504, and only after it the bug surfaced.

If we already grow our buffer past the value stored in the hostcache,
prefer our value.

Reviewed by:            tuexen
Differential Revision:  https://reviews.freebsd.org/D60105

pf_handle_get_srcnodes() returns with the lock of a source hash row
held when it cannot start the message for a source node.  Unlock the
row there, as the other error exit of the loop does.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=9c125336727b ("pf: convert DIOCGETSRCNODES to netlink")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60251

When the OpenFirmware loader flattens the firmware device tree into the
FDT it hands to the kernel (usefdt=1, i.e. on every real-mode OF system
such as pSeries LPARs and QEMU pseries guests), add_node_to_fdt() clamps
every property value to 1024 bytes.  Any larger property reaches the
kernel truncated.

On QEMU pseries the PCI host bridge's "interrupt-map" is 3584 bytes
(32 slots x 4 pins x 7 cells), so only the entries for slots 0-8 survive
and the entry for slot 9 is cut in the middle.  A PCI device in slot 9
or above therefore gets no INTx routing (irq 0), and with INVARIANTS the
partial trailing entry trips the "ofw_bus_search_intrmap: truncated map"
assertion in ofw_bus_search_intrmap() during PCI attach, panicking the
kernel as soon as such a device is present.  "ibm,drc-indexes",
"ibm,drc-names" and "ibm,drc-power-domains" are cut the same way.

Drop the clamp.  fdt_setprop() already reports a property that does not
fit into the FDT buffer, so no separate limit is needed.

Fixes:  https://cgit.freebsd.org/src/commit/?id=5ecf8e3852a9 ("Clean up some FDT-related code in the PowerPC bootloader, improving error checking and robustness. Prevents errors and crashes in FDT commands on PowerMac G5 systems.")

Differential Revision:  https://reviews.freebsd.org/D60086

Ability to override DHCP options with command-line arguments
was affected by intoduction of initmd support. Initmd discovery
configures the network before loader arguments
were parsed, so a dhcp.root-path override was unavailable
during the first network configuration. Move parsing
arguments earlier and apply dhcp.root-path even if DHCP response
does not contain option 17. This allows providing a dynamic NFS
root e.g. by chain loading loader.efi from iPXE.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    imp
Assisted by:    Github Copilot (GPT-5.6 Sol)
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D59998

DHCP initmd discovery used net_configure() to open and configure SNP,
then immediately closed the socket and released the protocol.
Selecting net0 as currdev subsequently required another exclusive
SNP attach, which may hang on some EDK II firmware.

Keep the configured socket available for ordinary network consumers
so NFS boot can reuse it. Add an explicit deconfiguration operation
and invoke it only when an initmd URL requires handing SNP back
to the firmware network stack.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    imp
Assisted by:    Github Copilot (GPT-5.6 Sol)
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D59999

pci_vtcon_announce_port() sends VIRTIO_CONSOLE_PORT_NAME immediately
after VIRTIO_CONSOLE_DEVICE_ADD, without waiting for the guest to
initialize the port.  The Windows virtio-serial driver ignores the
name if the port is not yet available, which can prevent the QEMU
guest agent from finding org.qemu.guest_agent.0.

Send the name after the guest reports successful port initialization
with VIRTIO_CONSOLE_PORT_READY, as QEMU does.

While here, validate the guest-supplied port ID before forming a
pointer into vsc_ports[].

This ports the PORT_NAME ordering fix from illumos change 18082.

Obtained from:  illumos 643ee887be44404b690eeaff14f20a27ad3c715c
Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D59847

paddr_guest2host() returns NULL when a range does not fit within guest
RAM.  An unmappable queue address previously left the queue marked
allocated with ring pointers computed from the failed mapping.  Check
the legacy virtqueue ring mapping before updating the queue state, and
ignore an unmappable PFN write after printing a diagnostic.  This leaves
an unallocated queue unallocated and preserves an existing queue's PFN,
ring pointers, flags, and indices.

Also check the indirect descriptor table mapping before dereferencing
it, returning an error if the table is unmappable, and ignore guest
queue notifications for unallocated queues.

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59904

c2d03a920ec7 rewrote the action printing in print_rule() from OpenBSD,
which has no natpass, and dropped the "pass" keyword.  A ruleset
loaded from "pfctl -sn" output therefore lost its nat-pass semantics.

Add a parser test covering nat, rdr, rdr log and binat with pass.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=c2d03a920ec7 ("pfctl: fix anchortypes bounds test")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60183

Handle empty strings for -Cand -S correctly.

Reported by:            maxim
Reviewed by:            maxim
MFC after:              1 week
MFC to:                 stable/14
MFC to:                 stable/15
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D60210

Remove semi-transparent pixels around the orb. These become more
pronounced when the orb is used as the spash screen image.

While here also strip metadata.

MFC after:      3 days
Reviewed by:    tsoome
Differential Revision:  https://reviews.freebsd.org/D60163

stand: Remove const from zfs_lookup's zfsmount argument

Dynamic system attribute layout can require modifications to the mount
structure on lookup. Drop the const to allow that.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60260

stand: zfs_dnode_stat move from spa to mount argument

When reading dynamic system attributes, we'll need the mount argument
since we can no longer hard-code the offsets. Adjust zfs_dnode_stat to
take it.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60261

stand: zfs_dnode_readlink move from spa to mount argument

For the dynamic system attributes, we'll need the mount argument. Adjust
zfs_dnode_readlink to take that argument.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60262

stand: Load dynamic system attribute offsets

zfs_sa_load looks up all the system attribute offsets and stores them in
the mountpoint.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60264

stand: Lookup the offsets for this SA bundle

Compute the offset for the data for this bundle and the requested data
type.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60265

stand: Lookup specific SA value in a dnode

zfs_dnode_sa_lookup will look in the bonus part of the dnode for the
requested SA values, and fall back to the spill as if it's not there.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60266

stand: update zfs_dnode_stat to use zfs_dnode_sa_lookup

Find the SA values with the zfs_dnode_sa_lookup and read out the
relevant bits for the stat buffer.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60267

stand: Implement zfs_dnode_readlink in terms of zfs_dnode_sa_lookup

Get the link offset using the zfs_dnode_sa_lookup helper now.

Recently, the symbolic links we rely on in the boot loader have stopped
working.

Prior to OpenZFS commit e90badec11d3 ("Inherit the project ID for every
object type", Matt Turner, 2026-08-14), symbolic link information was
written at a fixed offset in the SA data. Since that commit, the
inherited PROJIDs mean that all pools with quota enabled have started
writing symbolic links with a new, non-fixed offset. Old symbolic links
remained unchanged, but new ones were written with a different
offset. At work, we have all these things: rewritten BEs, quotas, and a
dependence on symbolic links in our boot path.

This came in on 2026-08-24 OpenZFS merge (22649d4dba73). This was 12
hours after stab week for August, so we didn't hit this until the
September stab week. Since the new kernel has to write links at the new
offset, the initial tests worked, but the second ones didn't.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D60268

Tested by:    adam.mizerski@ovhcloud.com
Sponsored by:   OVHcloud
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2446

Sponsored by:         Netflix

GCC 16[0][1] now requires a wrapper lib to handle
`--push-state --as-needed -lgcc_s --pop-state` logic[1]
for `gcc` invocations. `g++` will still unconditionally
use `-lgcc_s`.

This fixes buildworld with gcc16.

[0] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=8a99fdb70493df1294b53406913e5ea1fc971c13
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=123396

Reviewed by:    jhb
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59511

Reviewed by:  jhibbits
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59719

The regular powerpc64 core probes only checked the kernel ELF and thus
also matched minidumps.  In particular, the powerpc64le probe could
claim a minidump before the minidump backend and then reject it as an
invalid ELF core.

Exclude minidumps from both regular powerpc64 probes and add a
regression test that verifies a powerpc64le minidump reaches the
minidump parser.

Reviewed by:    jhibbits
Approved by:    olce (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=f4eb39ba6bc9 ("[PowerPC64LE] libkvm powerpc64le support.")
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59719

PowerPC64 radix minidumps use a 64KB root directory followed by three
levels of 4KB page tables.  Add an MMU backend which walks those tables,
handles large-page leaves, and decodes their always-big-endian entries
on both powerpc64 and powerpc64le.

Reject old radix minidumps whose pmap section is empty with a specific
diagnostic.  Add a synthetic powerpc64le dump test which reads a page
through both its kernel and direct-map addresses.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298532
Reviewed by:    jhb
Approved by:    jhb (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59743

The kernel sends PFR_A_AF as a u32, although it is documented and
parsed as a u8, and libpfctl decoded it with snl_attr_get_uint32()
straight into the u8 pfra_af.  That overwrote pfra_net, pfra_not and
pfra_fback, and left pfra_af zero on big-endian hosts.

Decode it via a temporary, and accept a u8 as well, so that the
kernel can be corrected later without breaking libpfctl.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=f27e44e2e3b5 ("pf: convert DIOCRGETADDRS to netlink")
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60110

libfetch: Limit response line length

When reading an FTP or HTTP response, error out if we read 64 kB before
hitting a newline.  Otherwise a runaway or malicious server could have
us spinning for quite a while allocating more and more memory before we
gave up or crashed.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60007

libfetch: Reject control characters in credentials

If a URL contains credentials, check that neither the user name nor the
password contain control characters which might confuse the server,
especially in the FTP case.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60008

libfetch: Correctly free redirect target

When processing a redirect, if we get multiple Location headers, we free
the previous one using free(new) instead of fetchFreeURL(new), which
leaks new->doc.

While here, rename new to loc since new is a reserved word in C++.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60015

libfetch: Plug leak in 304 Not Modified case

When we get a 304 Not Modified response, we need to go through the error
path to properly free any resources we've allocated instead of just
returning NULL directly.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60016

libfetch: Plug connection leaks in FTP code

When setting up an FTP transfer, we need to dereference the cached
connection before returning after a failure.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60017

The chunked table address functions (set, add, del, clr_astats) add
each chunk's result to the caller's counter without initialising it.
pfctl reuses nadd for the number of tables created, so a replace that
also creates the table is off by one:

pfctl -t foo -T replace 192.0.2.1

reports "2 addresses added".

Zero the counters first, as pfctl_test_addrs() already does. Remove
the workaround for the add case from pfctl (da64f6e047b5), which is
no longer needed.

Add a regression test.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60174

in particular, if the old environment is NULL.

Among making it less surprising for userspace to observe NULL environ,
the change also prevents NULL deref in __rebuild_environ() when
terminating the empty as NULL environment with the NULL pointer.

Reported by:     Leo Bicknell <bicknell@ufp.org>
PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298747
Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59996

Nothing in the tree calls any of the three.  Remove them rather than
fix them: pfctl_get_states_h() does the same with the handle that the
caller has.  pfctl_free_states(), struct pfctl_states and the list
entry in struct pfctl_state were there for pfctl_get_states() alone,
and go with it.

Reviewed by:            kp
Approved by:            kp (mentor)
Fixes:                  https://cgit.freebsd.org/src/commit/?id=2a478dfc7f9c ("libpfctl: retrieve family id only once")
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60248

Notable upstream pull request merges:
 #17864 e903655c5 zpool: Add zpool status -vv error ranges
 #18820 -multiple zdb: account pending DDT-log frees in leak detection
 #18884 -multiple zio_crypt: establish platform interface; rework common
                  code to use it
 #19010 -multiple zfs_namecheck: reject '.' and '..' before a snapshot or
                  bookmark
 #19031 994fb1703 Fix metaslab count assertion in metaslab_group_alloc()
                  for small vdevs
 #19093 f5b2fc8e2 zfs_ctldir: make .zfs/snapshot/<name> btime the snapshot
                  creation time
 #19097 2dece2a34 zstream: report invalid record context without assertions
 #19102 78f49e1dd vdev_disk: simplify alignment checks for linear ABDs
 #19108 -multiple Fix permanent errors misfiled into the scrub error log
 #19110 fa4bc4dec spa_errlog: don't let one unresolvable entry hide the
                  whole error log
 #19116 b6dde8a17 zio_crypt: free the key unwrap uios when decryption fails
 #19122 -multiple Fix dd_lock contention on space accounting
 #19126 c792317f2 Avoid dp_lock in the dirty space accounting
 #19131 7fd87803e Make the spa_config_lock reader fast path lockless
 #19137 a83d96835 libzfs: do not iterate snapshots for a mountpoint
                  changelist
 #19152 ccce78729 ZIO: Order a batch arrival against the hold it releases
 #19155 9d7260c9b Propagate vdev state change on probe failure
 #19157 946be3a33 FreeBSD: remove legacy ioctl support
 #19165 1d9c32c16 zpool: accept more redundant special and dedup vdevs
 #19167 638abd22a zfs_domount: fix vfs_t double-free on root setup failure

Obtained from:  OpenZFS
OpenZFS commit: 1f380a4f34da6068d22960807f53cda68a356add

When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode.  This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag.  For
regular fdescfs mounts, this metadata is copied via dupfdopen().

Fix the problem by passing up this metadata through the nameidata
structure.  Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n.  Add some
regression tests as well.

Approved by:    so
Security:       FreeBSD-SA-26:66.jail
Security:       CVE-2026-101304
Reported by:    Jan Bramkamp
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59886

When ufs_rename() moves a directory to a new parent and ufs_dirrewrite()
fails to rewrite its ".." entry, it reports "bad dir ... rename: missing
.. entry" whatever the error.  ufs_dirrewrite() never finds a missing
"..", though: it fails with EIDRM when the ".." entry names another inode
than the expected one, and otherwise only when the directory block cannot
be read or written.  The latter happens for every directory rename in
flight when the device goes away under a forcibly unmounted file system,
and the log then fills with reports of directories that are intact on
disk.

Report the EIDRM case with ufs_dirbad() in ufs_dirrewrite() itself, so
that all of its callers get the same diagnostic, and drop the report
from ufs_rename().  Errors from the lower layers are not reported, as
usual for an I/O initiator.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D60137

cuse: Fix hang on readv(2) and writev(2) with multiple iovecs

uiomove() leaves an iovec it has just emptied as the current one, so
cuse_client_read() and cuse_client_write() picked it up again on the
next iteration, sent the server a zero-length command, and got zero
bytes back. That left the residual count unchanged, so the loop never
terminated and the call never returned.

Step past empty iovecs at the start of every iteration. This also covers
caller-supplied zero-length iovecs, which hung in the same way

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293489
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D59822

cuse: Actually use cuse_modevent()

We can call cuse_kern_init()/cuse_kern_uninit() here, rather than using
SYSINIT/SYSUNINIT.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59862

cuse: Create /dev/cuse with MAKEDEV_CHECKNAME

Since we now use make_dev_credf(), make sure to fail kldload if it
returned NULL.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59863

cuse: Improve server cleanup

Move cuse_server_unref()'s device cleanup loop into a new
cuse_server_free_devs_locked(), and call it from cuse_server_free()
instead. The cdevpriv destructor now destroys the server's devices
before dropping its reference, which closes the clients using them, so
that the destructor is always the one that takes the last reference.

By the time cuse_server_unref() frees the server, the device list should
be empty, so assert this.

In cuse_kern_uninit(), delete the infinite loop which waits for all open
/dev/cuse instances to exit, and instead call destroy_dev() directly,
which runs their cdevpriv destructor.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59872

cuse: Remove unnecessary semicolon in cuse_convert_error()

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

cuse: Retire unnecessary CUSE_VERSION

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

cuse: Use make_dev_s() to create client devices

make_dev_s() sets si_drv1 before the node is published in devfs, which
avoids a race where cuse_client_open() could see it as NULL. It also now
reports finer-grained errors on failure, instead of only ENOMEM.

While here, drop the NULL checks on kern_dev in cuse_server_free_dev(),
since a device is only added to the server's list once it has been
created.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59874

cuse: Implement hot-unload

cuse_kern_uninit() can hang on destroy_dev(), because of threads
sleeping in CUSE_IOCTL_GET_COMMAND, so implement d_purge to wake them up
before calling destroy_dev(). Also do not allow threads to go back to
sleep if the is_closing flag has been set.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D60022

cuse: Assert the server refcount

Assert that the refcount does not underflow before decrementing it, and
that it really is zero by the time the server is freed.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D60043

cuse: Rename cuse_server_free() to cuse_server_dtor()

This name is clearer, given that this function is the cdevpriv
destructor callback.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

zpool: Add zpool status -vv error ranges (#17864)

Add necessery change to libzfs/Makefile

(cherry picked from commit e903655c50fe2e710a4cdfe6e638454012ef6324)

flush_pagedep_deps() drops the soft updates lock while obtaining the
vnode of a newly created directory with get_parent_vp().  The
MKDIR_BODY dependency may complete during this interval, invalidating
the diradd selected before the lock was dropped.

Once the directory's allocdirect is retired, the lookup of its first
block by block number in flush_newblk_dep() can find an older
dependency for a previous use of the same physical block.  The newblk
hash is not unique by block number: when ffs_reallocblks() relocates a
cluster, the completed allocindirs of the old blocks stay on the
indirdep's ir_completehd until the indirect block pointer in the inode
is written, while the old blocks are already free and may be allocated
to a new directory.  flush_newblk_dep() then finds a D_ALLOCINDIR where
it expects a D_ALLOCDIRECT and panics with "flush_newblk_dep: Bad
newblk".

Retain the vnode returned by get_parent_vp(), reacquire the soft
updates lock, and restart dependency selection.  Use the retained vnode
only when the newly selected MKDIR_BODY dependency refers to the same
inode.

Enter flush_newblk_dep() with the soft updates lock held and pass it
the associated diradd.  Recheck MKDIR_BODY after every operation that
may drop the lock, so that completion during the helper's retry loop
cannot result in another lookup of the retired allocation.

Keep the vnode handling in flush_pagedep_deps(), which owns the retained
vnode and the list of unfinished diradds, and move the dependency
selection into flush_pagedep_deps1().  The latter never acquires or
releases a vnode: it returns EJUSTRETURN with the inode number when it
needs one, or with 0 when the retained vnode must be released first,
and every call restarts the selection, so a vnode is only used for a
diradd found while it was held.  This also merges the two
get_parent_vp() call sites.  Every restart goes through that return:
obtaining or releasing a vnode, and continuing after jwait() or
getdirtybuf() had to wait with the softdep lock dropped.  The diradds
deferred on the unfinished list are put back on the pagedep's list
before the lock is dropped for a restart, so that none are kept off it
while other threads can run.  Assert that flush_newblk_dep() is called
with the vnode exclusively locked.

This preserves the original newblk dependency ordering and retains the
existing assertion for an active MKDIR_BODY dependency that resolves to
an unexpected dependency type.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297976
Reviewed by:    kib
Tested by:      pho
Sponsored by:   Sippy Software, Inc.
Differential revision:  https://reviews.freebsd.org/D59356

I do not think that xp_p2 can be NULL at this point,
but add an extra safety belt, just in case.

Reviewed by:    rmacklem
MFC after:      1 week
Sponsored by:   VersatusHPC

This keeps it in sync with sys/modules/ibcore/Makefile and
fixes the build on GCC 16 after the changes to -Wunused*[0].

[0] https://gcc.gnu.org/gcc-16/porting_to.html#changes-to-wunused

Reviewed by:    jhb
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59539

We have always returned EPERM in this case, but it's incorrect, we
should return ECAPMODE for capability mode violations.  Fix the errno
value.

Reviewed by:    emaste
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D59887

The subsequent namei() call is relative to AT_FDCWD, and such lookups
are always disallowed in capability mode.

No functional change intended.

Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D59888

semop() may sleep waiting for a semaphore.  Upon waking up, it checks to
see if the set's sequence number has changed, indicating that the set
was removed.  The sequence number is not wide enough to prevent a false
negative due to wraparound, in which case the subsequent access of
`semakptr->u.__sem_base[sopptr->sem_num]` may be out of bounds.  This
race can be leveraged to elevate privileges.

Fix this by introducing a 64-bit sequence number for each semaphore
pool.  This is wide enough to make the race impossible to hit.  Allocate
a separate array for them, as we cannot really change the layout of
struct semid_kernel since some userspace tools (e.g., ipcrm(1)) embed
the layout.

While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to be bool, and use a better variable name to
store required permissions.

Approved by:    so
Security:       FreeBSD-SA-26:64.sysvsem
Security:       CVE-2026-58098
Reported by:    Reo Shiseki
Reported by:    Andrew Griffiths
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59347

Commit d8bdcb08d0eb fixed a problem in kqueue_fork_copy_knote() where we
did not skip over marker knotes when copying.  However, that fix was not
sufficient: we bump the influx counter and check for a marker after
dropping the kqueue lock.  So, if multiple threads in a process are
forking concurrently, kqueue_fork_copy_list() may mark a marker as
in-flux and drop the lock; if the marker owner then frees the marker,
the first thread will decrement the in-flux counter of a freed knotes.
This use-after-free can be exploited, at least prior to commit
d8bdcb08d0eb, which makes exploitation more challenging.

Approved by:    so
Security:       FreeBSD-SA-26:65.kqueue
Security:       CVE-2026-58099
Reported by:    Reo Shiseki
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59522

Here, fdp points to the new fdtable, copied from that of the parent
process.  There is a window after the fdtable is copied, and before
kqueue_fork_copy_knote() runs, where a different thread in the parent
could have grown the parent's fdtable and registered a knote with ident
larger than the size of the child's fdtable.  This race can lead to an
out-of-bounds read.

Add a bounds check for this case; skip the knote if it is referencing a
non-existent file.

Approved by:    so
Security:       FreeBSD-SA-26:65.kqueue
Security:       CVE-2026-58100
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59916

In a couple of places we want to know whether someone has limited rights
on an fd.  There, we want a predicate which determines whether the set
of rights is smaller than CAP_ALL, and whether there are explicit ioctl
or fcntl lists.  Factor this out into a helper function, in preparation
for use elsewhere.

No functional change intended.

Approved by:    so
Security:       FreeBSD-SA-26:66.jail
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59884

These routines let one compute the intersection of two sets of filecaps
or capability rights, just as filecaps_merge() and cap_rights_merge()
compute the union.  This will be useful in an upcoming patch.

filecaps_intersect() is complex due to the need to merge sets of ioctls.
For now this is implemented with a dumb nested loop on the basis that
ioctl lists are typically short enough that this is fine.  It may be
better to instead sort the two lists first and step through them
together.

No functional change intended.

Approved by:    so
Security:       FreeBSD-SA-26:66.jail
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59885

The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR
262179 without entirely disallowing fd passing between jails.  However,
one can use renameat() to bypass the restriction: upon receiving a
directory fd with FD_RESOLVE_BENEATH set, a jailed process can still
move its CWD or one of its ancestors to the directory, and just cd
out of its jail root.

So disallow renameat() when either the source or destination directory
fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot()
to prevent similar escapes.

Approved by:    so
Security:       FreeBSD-SA-26:66.jail
Security:       CVE-2026-101305
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262179
Reported by:    firk@cantconnect.ru
Reviewed by:    olce, kib
Differential Revision:  https://reviews.freebsd.org/D59875

This function take a struct uio previously created by copyinuio and and
updates the lengths of the user-space iovec to match those in the uio.

To reduce the risks of pointer leakage and cross-ABI pointer confusion,
lengths are updated individually.

Reviewed by:    jamie, jhb
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D60025

This will enable compat implementations in the future.

Reviewed by:    jamie, jhb
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D60026

I suspect this overflow check isn't needed at all, at least today, since
vm_map_insert() will detect wraparound when it creates segments (and
even a check against UINT_MAX is too loose, since the max user address
is AOUT32_USRSTACK == 0xbfc00000).  But if we're going to keep this
check, there doesn't seem to be any downside to applying it on all
platforms, before exec_new_vmspace() tears down the current vmspace.

Reported by:    Muhammed Sariyildiz <asiyee994@gmail.com>
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60027

vm_swapout: Restore handling of RLIMIT_RSS

In commit 13a1129d700c, I removed the mechanism by which the pagedaemon
signals the swapout thread when page reclamation is unable to keep up
with demand.  This is because the swapout thread's main action in this
case is to swap out sleeping processes, but we removed this support.

However, it had the secondary effect of causing the swapout thread to
enforce RLIMIT_RSS when racct is not enabled.  Without it, if
racct_enabled is false, nothing ever kicks the swapout thread.

Restore the old behaviour of trying to enforce RLIMIT_RSS when the page
daemon is unable to keep up with demand.  I'm not at all convinced this
is a good way to implement the limit, but the change wasn't intentional,
so let's restore it for now.

Fixes:          https://cgit.freebsd.org/src/commit/?id=13a1129d700c ("vm: Remove kernel stack swapping support, part 1")
Reviewed by:    olce, kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56142

vm_swapout: Fix the build without options RACCT

Reported by:    Jenkins
Fixes:          https://cgit.freebsd.org/src/commit/?id=da0764f23554 ("vm_swapout: Restore handling of RLIMIT_RSS")

amd64: Revert an unintended change to GENERIC

Fixes:  https://cgit.freebsd.org/src/commit/?id=767cd9bb4200 ("vm_swapout: Fix the build without options RACCT")

The freebsd14_setgroups() function would try to modify the effective GID
on the current process' credentials without holding the process lock,
allowing races with other threads concurrently modifying the process
credentials.  In the worst case, freebsd14_setgroups() could be
manipulating a 'struct ucred' already freed by another thread (in the
very small window after reading 'p_ucred' without lock but before
modifying the effective GID).  Concurrent uses of freebsd14_setgroups()
or setcred() could also lead to non-atomic credentials modifications.

Fix this by making kern_setgroups() take a new boolean indicating
whether the passed array includes the effective GID in its first slot.
When this boolean is true, it internally keeps the effective GID in
a separate variable, pretends that the groups[] array that was passed
actually starts at 'groups + 1', do the usual steps to set the
supplementary groups and new extra ones to set the effective GID along,
without releasing the process lock in between.

Reported by:    markj
Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60028

MFC with:       e6fbef451dd4 ("cred: Fix a race in the FreeBSD-14-compatible setgroups(2)")
Sponsored by:   The FreeBSD Foundation

epoch_trace_report() assigned the return value of RB_INSERT() back to
the new element. When two threads report the same stack concurrently,
the loser's RB_INSERT() returns the element already in the tree, and
that element was freed while still linked, leaking the new allocation.
The next lookup touches freed memory; KASAN catches it as a
use-after-free.

Keep the return value separate and free the new element instead. The
thread that won the race prints the report, so return without printing
it a second time.

Reviewed by:            markj
Fixes:                  https://cgit.freebsd.org/src/commit/?id=173c062a569b ("Improve EPOCH_TRACE")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60162

This is consistent with other system call helpers.

Reviewed by:    markj
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D60173

Reviewed by:  jah, sobomax, markj, olce
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59910

All architectures have been providing an 'ifunc.h' header with
DEFINE_IFUNC() et alter working both in kernel and userland since commit
cf41d1113377 ("riscv: implement kernel ifunc resolution"), and separate
<i386/ifunc.h> and <amd64/ifunc.h> headers were introduced in commit
2b1db07bec92 ("x86: add machine/ifunc.h"), so stop including
<x86/ifunc.h> directly and use the common <machine/ifunc.h> idiom.

While here, re-order includes in the blocks featuring <x86/ifunc.h>,
which requires fixing <x86/apicvar.h> so that it can be included before
<machine/intr_machdep.h>.

Reviewed by:    kib
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60194

First, record the original lowat value and later in the wait/EAGAIN loop
look at the original value, rather than on the value that we just faked.
This eliminates some blank syscalls, where socket was reported as writable
and immediate write instantly fails.  In my testing the ratio of such
syscalls was really small, under 2%, however in a different scenario this
negative effect can be more profound.

Second, cap the lowat growth to 1/2 of original socket buffer size, rather
than to current size.  The problem was there before, but it became more
profound after 587c6c121504.

Note: we are considering to evaluate if the lowat hack is needed at all.

Reviewed by:            tuexen
Differential Revision:  https://reviews.freebsd.org/D60106

"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.

Reported by:    Andrew <xxx.sys@protonmail.com>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

When softclock_call_cc() fails to acquire the lock of a CALLOUT_TRYLOCK
callout, it reschedules the callout half its precision after
cc_lastscan and halves the precision. Repeated failures shrink the
delay toward zero, and once the precision reaches 1 the callout is due
immediately: the timer fires again at once and softclock retries the
lock in a tight loop for as long as the lock is held.

If the lock owner runs on the callout's CPU and no other CPU is idle,
the softclock thread preempts it on every attempt, starving the thread
it is waiting on. On an 8-CPU arm64 VM, a test module holding the lock
saw 760,000 attempts per second, each with its own timer interrupt, and
progressed at 38% of its normal rate. On a 4-core amd64 system under
loopback TCP load, a netisr thread holding an inpcb lock made no
progress for 12 minutes while the TCP timer callout was retried 830,000
times per second.

Keep the half-precision retry, but never schedule it less than one
tick from now. Base the deadline on sbinuptime() rather than
cc_lastscan: cc_lastscan is the time of the last callout_process()
scan, which can be a tick or more in the past by the time softclock
runs the callout, leaving cc_lastscan + tick_sbt already expired.

Floor the precision at a tick as well. With a precision of 1 the
retries of many contended callouts cannot share a timer interrupt: the
timer is armed for the earliest retry, each interrupt collects only
those already due, and every callout_process() call walks all the
contended callouts in the callwheel bucket. On the same VM, with
10,000 callouts on one lock, the owner took 5.0 to 5.8 s to finish 1 s
of work with a precision of 1 and 1.3 s with the floor, and
callout_process() ran about 58,000 times against about 900. A single
contended callout is now retried about every two ticks.

Reviewed by:            kib
Fixes:                  https://cgit.freebsd.org/src/commit/?id=efcb2ec8cb81 ("callout: provide CALLOUT_TRYLOCK flag")
MFC after:              2 weeks
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D60246

This patch updates the NFS client RDMA glue so that I/O
can be done directly to/from b_pages for buffer cache
blocks.
It also adds a flag to disable read reduction, that might
be needed against some non-FreeBSD servers and sets readahead
to 8 for RDMA unless the "readahead" option has been
specified.

This commit should not affect non-RDMA behaviour.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

This patch does not fix any semantics issue.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

So if one inserts a USB drive with a GPT that doesn't match the media
size, a resize is initiated, so gpart takes g_access(cp, 1, 1, 1) on the
disk and holds it until the resize is accepted or rejected. The orphan
path releases it, but the spoil path does not. So if the drive is
ejected while the resize is in flight, we call spoil directly, without
releasing the access. Since gpt_opened is not cleared for the spoil
path, this causes several different process to hang in the open path
waiting for the leaked access.

Move the release into the wither function when gpt_opened is set, and
remove the release elsewhere. Since all paths to destroy the geom pass
through wither, this ensure that access is always released when we've
taken the access for resize.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297777
Reported by:            Rick Richard
MFC After:              1 week
Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D59138

When clnt_vc_destroy() is called, it might not be the
current connection.  Without this patch, if it is not
the current connection, xp_p2 is set NULL and xprt is released
when it should not be released.

This patch adds a check for "current connection" to fix
the problem.  Found during testing to the client RDMA code,
but could happen for TCP as well.

MFC after:      1 week

After more than, I don't know, maybe 10k operations: mount, copy,
remove, verify and unmount cycles, one cp command hung in
close() / ncl_flush and never recovered. The machine and the mount
continued to work normally through a new connection, but the writes
using the old connection stayed frozen.

I did not understand exactly what happened.  I traced what appears to
be the issue in the code. My current understanding is that
clnt_vc_soupcall() saw the EOF and woke the caller waiting for RPC
replies, but one caller remained blocked in sosend().
That thread continued holding a reference to the old client, preventing
it from being completely cleaned up.

The attached patch calls socantsendmore() when EOF is received, which
should wake the blocked sender and let the normal reconnect code replace
the connection.

Reviewed by:    rmacklem
MFC after:      1 week
Sponsored by:   VersatusHPC

For consistency, create a symbolic link from ena.4 to also if_ena.4

Reviewed by:            #manpages, ziaee
Differential Revision:  https://reviews.freebsd.org/D60191
MFC after:              3 days

Starting with version 1.5.0, bsdec2-image-upload supports uploading
stream-optimized VMDK files.  If we build images in that format, we
need to upload them appropriately.

MFC after:      2 weeks
Sponsored by:   Amazon

Once enabled on all of the branches, this will reduce bandwidth
consumption from uploading weekly snapshot builds from ~500 GB to
~100 GB, as well as significantly speeding up the process.

MFC after:      2 months
Sponsored by:   Amazon

Approved by: imp (mentor), des (mentor)
Differential Revision: https://reviews.freebsd.org/D59871

Approved by: imp (mentor), des (mentor)
Differential Revision: https://reviews.freebsd.org/D59871

Approved by: imp (mentor), des (mentor)
Differential Revision: https://reviews.freebsd.org/D59871

Approved by:  nprice
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D60145

Approved by:  asomers
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D60144

geom_subr.sh serves both legacy TAP tests and ATF tests. It defaults to the
TAP path, so ATF tests must set ATF_TEST=true before sourcing it.

Sponsored by:   Netflix

This fixes the build with gcc 16 after the changes
to -Wunused*[0].

[0] https://gcc.gnu.org/gcc-16/porting_to.html#changes-to-wunused

Reviewed by:    netchild
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

linux and linux64 are file names, not module names.  The corresponding
module names are linuxelf and linux64elf, respectively, so these tests
were always being skipped.

Fixes:          https://cgit.freebsd.org/src/commit/?id=b98d169d1f91 ("tests/sys/vfs: add ABI-root absolute symlink tests")
Sponsored by:   The FreeBSD Foundation

gnop6.sh recorded the checkfs result with "checkfs ... || s=1 && s=0",
which the shell parses as "(checkfs || s=1) && s=0", so the test passed
even when the file system check failed.

gnop7.sh only sets s when unmount or fsck_ffs fails and ends with
"exit $s".  On a clean run s is unset, and the script exits with the
status of the preceding "[ $notloaded ] && gnop unload", which is 1
whenever geom_nop was already loaded, for instance by an earlier test.

fdatasync.sh and fdatasync2.sh ran "df -i $RUNDIR" before creating the
directory.  With a RUNDIR that does not exist yet, df failed, the test
printed "[: -lt: unexpected operator" and the free inode check was
skipped.

Reviewed by:    pho
Differential Revision:  https://reviews.freebsd.org/D60136
Sponsored by:   Sippy Software, Inc.
MFC after:      2 weeks

This is the 'stream-optimized' version of the VMDK format.

MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60154

flush_pagedep_deps() drops the soft updates lock to obtain the vnode of
a new directory.  If its MKDIR_BODY dependency completes in that window,
the lookup of the directory's first block in flush_newblk_dep() can find
a stale allocindir left behind by a previous owner of the same block,
relocated by ffs_reallocblks() and freed, and panic.

The test grows interleaved files past UFS_NDADDR to keep clusters being
relocated, while other workers create subdirectories in a parent with
IN_ENDOFF set, so that ffs_vput_pair() syncs it, and fsync() them to
complete the mkdir dependencies.  The file system layout and the way
the writers put their blocks on disk are arranged so that a new
directory takes over a freed block whose dependency is still retained;
the details are in the script.  With dtrace=1, the test also counts how
often this precondition is met, which works on a fixed kernel too.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297976
Reviewed by:    kib, pho
Tested by:      pho
Sponsored by:   Sippy Software, Inc.
Differential revision:  https://reviews.freebsd.org/D59356

This is a commit from upstream to fix:
  dtls: reset init_off before retransmitting a message

Approved by:    so
Security:       FreeBSD-SA-26:68.openssl
Security:       CVE-2026-84782

Changes: https://github.com/eggert/tz/blob/2026e/NEWS

Briefly:
    Manitoba moves to permanent -05 on 2026-10-31.

MFC after:      3 days

MFC after:    1 week

  [Clang][ExprConst] Drop PRValue for nothrow new (#226753)

  A user defined operator new can accept prvalue for nothrow. However, it
  should not be a ConstExpr. Early returns by
  isUsableAsGlobalAllocationFunctionInConstantEvaluation instead of doing
  LValue evaluation.
  Also, move CheckPlacement new logic into new OpCode. This decouples
  checking from Interp.cpp to Compiler.cpp.

This fixes "Assertion failed: (E->isGLValue() ||
E->getType()->isFunctionType() || E->getType()->isVoidType() ||
isa<ObjCSelectorExpr>(E->IgnoreParens())), function EvaluateLValue" when
building the databases/mariadb123-server port.

MFC after:      1 week

This is a security fix release addressing CVE High issues. Users are
strongly encouraged to update to this version.

See the release notes for the release for more details on what is being
fixed.

MFC after:      1 day
Merge commit 'af5a659dc1cd2b0a6994f2cee1956d0bf50bb1a2'

A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "version bump" update
(3.5.8 -> 3.5.9).

MFC after:      1 day
MFC with:       b3a31d78

  [DebugInfo] Fill Column 0 if Line is not found (#227559)

  It is possible that user specified line 0 as the start of the line in C
  language (using `# 0`). However, it is rejected by the Lexer as we have
  no line but still carries column information. As a result, we fill
  column to 0 if we cannot find line.

  Assisted-by: Claude # Test
  Fixes: #56186

This fixes a fatal error when building the textproc/peg port.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264853
MFC after:      3 days

In the event `NDEBUG` was defined, `assert` would become a no-op,
breaking some of the expectations in `assert_test` around `assert(..)`
failing generating a coredump.

This is a better approach than the previous one committed in 6f3445006a
as it continues to test the `assert(..)` function instead of just
skipping it if `NDEBUG` was defined.

Suggested by:   kevans
MFC after:      4 days
MFC with:       6f3445006a
Fixes:          https://cgit.freebsd.org/src/commit/?id=6f3445006a
Differential Revision: https://reviews.freebsd.org/D60253

  [Clang][Sema] Create LocalScope for Variable Template (#228280)

  A variable template should create its own LocalScope, as it should be
  opaque to other instantiations. This can occur when there are multiple
  instantiations in the same lexical scope. The correct behavior is that
  these instantiations should not be chained together.

  Assisted-by: Claude # Test ReleaseNote
  Fixes: #134148

This fixes an assertion while building the devel/glaze port.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=276265
MFC after:      3 days

zfs: add btree.c to libzfs

Fixes breakage from 34f9f5680 (openzfs/zfs@1f380a4f3)

Revert "zfs: add btree.c to libzfs"

This reverts commit b4fdb5c236d00825c8e3ea8ffc7bc25dafb6abcf.

This reverts commit e903655c50fe2e710a4cdfe6e638454012ef6324.

The commit comes from the OpenZFS merge.

OpenZFS introduced in d2f5cb3a5 two new libraries: libbtree and
librange_tree. We don't have these in our build.

To keep diffs as minimal as possible and avoid future breakages we
should import these for the FreeBSD build with bells and whistles.

After this issue is resolved, e903655c5 can be re-committed.